Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/07/2026, 07:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10ltsc2021-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win11-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target setup.exe
- Size 18.7MB
- Sample260729-h8p3dsfa39
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1528 88cab8345c536ad243be51858f1282d1.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 792 setup.exe 1528 88cab8345c536ad243be51858f1282d1.exe 1528 88cab8345c536ad243be51858f1282d1.exe 1528 88cab8345c536ad243be51858f1282d1.exe 1528 88cab8345c536ad243be51858f1282d1.exe 1528 88cab8345c536ad243be51858f1282d1.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 792 setup.exe Token: SeDebugPrivilege 1528 88cab8345c536ad243be51858f1282d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
-
C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exeC:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\88cab8345c536ad243be51858f1282d1.exe
- Size 18.7MB
- SHA256 376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88
- MD5 f5cb2ff0db067434db4f3f1118e2eb2e
- SHA1 7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752
- SHA512 6ba081dc8e9aef3bac08ceb92b3b5c2352e2cf2e96a66de13b5faf46712467baca2650e5e0c08f426b864d610a5ecc1ac49dea70acc00e66ef1f5a5bc21a2aea
- SSDEEP 98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop
- TLSH T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\88cab8345c536ad243be51858f1282d1\agent.json
- Size 399B
- SHA256 3d54bb9544b2dbfc14d2fbbdea5a9d32eb600b6246533c47360ccae4fd5095e4
- MD5 424764cb73dabf30299444a38af29562
- SHA1 da20cd25755181f784eaadc919ad17f03a619185
- SHA512 8a4ca0e2140d83f7c60f45ad7e32af34a5dc7479728a48be526a3fe80040ccce82dce0ebc6e3980aad57387c45bf3e0d9cbc417bf1cc10c86de65fd63c0cfcd8
- TLSH T179E0F18D235804B7FBDC263528CB056839D08D0C5B7280800945C679B02755AD024E75
- MD5 SHA1 SHA512 TLSH